Monthly control self-assessment

🛡️ purpose monthly attestation cycle in which each control owner in the control register distribution confirms their controls operated, with evidence, and records any failures owner distribution operations manager · cycle calendar month, attestations due by working day 5 🔄 monthly attestation lifecycle flowchart lr a\[coordinator issues workbook] > b\[control owners test controls] b > c\[ratings and evidence submitted] c > d{any failures or exceptions?} d yes > e\[root cause and remediation logged] e > f\[compliance escalation if regulatory impact] d no > g\[coordinator consolidates results] f > g g > h\[monthly ops review] 👥 roles and responsibilities issue attestation workbook on working day 1 validate completeness of submissions consolidate monthly results escalate overdue attestations table outcomes at monthly ops review test assigned controls for the month retain evidence supporting control operation record honest effectiveness ratings document remediation actions for failures or exceptions review escalated failed controls with regulatory impact monitor remediation progress for material issues support regulatory reporting obligations where required 📋 procedure on working day 1, the coordinator issues the attestation workbook listing each control, its owner and its evidence requirement each control owner tests their control for the month sample based for per transaction controls (minimum 5 items or 10% of volume, whichever is greater) report based for continuous and detective controls the owner records a rating ✅ effective , ⚠️ effective with exceptions , or ❌ failed , and attaches evidence for any rating other than effective record root cause, remediation action, action owner and target date root cause means the underlying reason, not a restatement of the failure the coordinator consolidates results by working day 5 and tables them at the monthly ops review (see process performance reviews ) failed controls with regulatory impact are escalated to compliance within 24 hours of identification — do not wait for the monthly cycle 🔄 remediation lifecycle status definition owner expectation escalation open failure identified and remediation agreed action owner updates progress weekly coordinator monitors in progress remediation execution underway evidence retained for validation escalate if target date at risk pending validation action implemented awaiting retest control owner provides supporting evidence coordinator validates closure readiness closed remediation validated and effective evidence archived with attestation record no further escalation required 🧾 evidence expectations evidence must be retained in a centrally accessible repository screenshots must include visible timestamps or report run dates sampling support must identify the tested population and selected sample evidence links should remain accessible for a minimum of 24 months ⚠️ honesty rule ⚠️ governance expectation ratings are never negotiated a failure honestly recorded and remediated is the process working as designed overdue remediation actions appear on the distribution scorecard until closed 🕘 revision history